CVE-2024-28253 SpEL Injection in `PUT /api/v1/policies` in OpenMetadata
An attacker can achieve remote code execution by injecting Spring Expression Language payloads into policy creation requests before authorization checks occur.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28253?
CVE-2024-28253 is a critical code injection vulnerability in open-metadata OpenMetadata, published on 15 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/policies` which gets handled by `PolicyResource.createOrUpdate()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-252`. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2024-28253?
2 open source packages ship an affected version, including org.open-metadata:openmetadata-service. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.open-metadata:openmetadata-service Maven | All versions | 1.3.1 |
org.open-metadata:openmetadata-service Maven | All versions | 1.3.1 |
Products include Open-Metadata Openmetadata.
How do I fix CVE-2024-28253?
Upgrade org.open-metadata:openmetadata-service to 1.3.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-28253 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28253 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in open-metadata OpenMetadata
- CVE-2024-28255 Authentication Bypass in OpenMetadata
- CVE-2024-28254 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata
- CVE-2024-28847 SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata
- CVE-2024-28848 SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata
- CVE-2026-22244 OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE
Sources
Also known as GHSA-7vf4-x5m2-r6gr.